Cutting the data transfer bill: a playbook for the invisible line

Data transfer is the only major cost line with no resource behind it. You cannot right-size it, you cannot delete it, and the bill gives you a per GB total rather than telling you which service sent the bytes. That opacity is why it reaches 10 to 20 percent of a bill in data heavy architectures before anyone investigates.

The rate card that decides priority

Step 1: find where the bytes go

Enable flow logs and query them by source, destination, and byte count. Group results into the categories above. Most teams find one or two flows account for the majority of transfer cost, and they are usually a surprise: a monitoring agent shipping full resolution metrics to a third party, a replication stream between zones, or a service calling an external API through a NAT gateway several million times a day.

Do this before optimising anything. Transfer optimisation done on intuition targets the visible flows, customer downloads, while the actual cost is often internal chatter nobody has thought about.

Step 2: kill NAT gateway processing with endpoints

This is usually the fastest large win. Any traffic from a private subnet to a cloud service (object storage, queues, container registries, secret stores) routes through the NAT gateway by default and pays $0.045 per GB in processing on top of the hourly charge. A private endpoint for that service removes the processing charge entirely for gateway style endpoints, or replaces it with a lower per GB rate for interface endpoints.

An application pulling 50 TB a month from object storage through a NAT gateway pays about $2,250 in processing. Add a gateway endpoint and that goes to zero. Container image pulls are the other classic: a large cluster pulling multi gigabyte images on every scale out event can generate terabytes monthly. Details in NAT gateway cost optimization.

Step 3: the cross zone traffic nobody accounts for

Cross availability zone transfer at $0.01 per GB in each direction sounds trivial and is not, because it applies to internal traffic at internal volumes. A chatty microservice mesh where every call has a two thirds chance of crossing a zone, a database replicating synchronously across zones, or a Kafka cluster with cross zone consumers can each generate tens of terabytes a month. 100 TB of cross zone traffic is $2,000 a month across both directions.

The fixes: topology aware routing so a service prefers endpoints in its own zone, rack awareness on distributed data systems so consumers read from local replicas, and consolidating chatty service pairs into the same zone. The trade off is explicit: zonal locality reduces transfer cost and reduces resilience to a zone failure, so this is a decision for architects, not a blanket policy.

Step 4: put a CDN in front of internet egress

At roughly $0.09 per GB on AWS, 100 TB of monthly internet egress is about $9,000. CDN delivery rates are typically lower per GB, and more importantly transfer from origin to the CDN is often discounted or free, so a cache hit ratio of 85 percent means only 15 TB leaves the origin. That combination commonly cuts egress spend 50 to 70 percent while also improving latency.

Two cheaper levers belong here too. Compression on text, JSON, and API responses typically reduces payload size 60 to 80 percent and is often a single configuration line. And pagination or field selection on chatty APIs reduces bytes at the source, which is always cheaper than moving them efficiently. The checklist is in the egress cost reduction checklist.

Step 5: check the architecture for avoidable crossings

Some transfer cost is structural. A service in one region reading from a database in another pays $0.02 per GB on every query. Logs shipped raw to a third party platform pay egress on every line. A backup replicated to a second region pays transfer on every byte. Each of these may be justified, but each should be a deliberate decision with a known monthly cost rather than an inherited default.

Expected outcome

A full pass typically cuts transfer spend 40 to 70 percent, and the savings persist because they are architectural rather than operational. On a bill where transfer is $30,000 a month, that is $12,000 to $21,000. The durable control is pricing network architecture before it ships: cross zone placement, NAT routing, and region choices are cheap to change in a Terraform review and expensive to change once traffic depends on them. Price them against the resource catalog and see data egress cost optimization for the deeper treatment.

FAQ

What to do next

Price the network architecture before traffic depends on it. C3X costs Terraform against a live resource catalog. Start with the quickstart.